I've talked to some employees of TrueSec (the firm that just discovered the Yosemite "rootpipe" exploit) and they told me that many security research firms are "on retainer" with intelligence agencies. They didn't share specifics but they said that they have friends who are paid to share exploits with, say, British Intelligence and to not report it to the vendor with the exploit in it.
I assume this is why Stuxnet had so many zero-day exploits in it. The agencies behind it had security firms feeding them.
I assume this is why Stuxnet had so many zero-day exploits in it. The agencies behind it had security firms feeding them.
http://www.wired.com/2014/11/countdown-to-zero-day-stuxnet/